Claude Code put user emails in web request headers

Your AI coding agent may have handed your email address to websites you never chose to contact. That is the short version of GitHub issue #107757 in the anthropics/claude-code repository, filed on November 5, 2026. The reporter wrote that Claude Code put their account email into the User-Agent header of web requests made during research, and that they now receive dozens of scam emails per day.

If you use Claude Code with a claude.ai login, this is not an abstract privacy debate. It means the address you used to sign in could sit in the server logs of any API or site your agent called on its own. The thread reached 1,588 points and 513 comments on Hacker News, and one tester reported that 8 of 60 real Claude Code runs leaked the address when no guard was in place.

What actually happened

The User-Agent is a plain text header that every HTTP client sends to identify itself. Browsers send long strings with version numbers. Command line tools like curl send something short. Some public data services ask scripted clients to add a way to reach the operator. The U.S. Securities and Exchange Commission is the clearest example: its Accessing EDGAR Data page asks automated tools to declare a user agent in the form of a company name plus an admin contact email. Wikipedia and several hobby APIs have similar policies.

Claude Code is an agent. When it needs data, it often writes its own shell commands, such as a curl call or a short Python script. For signed-in users, the account email was part of the context the model received at the start of every session. So when a site asked for a contact, the model sometimes did what a polite script author would do: it put an email address in the header. The address it had at hand was yours.

Anthropic's Lydia Hallie, who works on Claude Code, explained the chain on Hacker News. Users had complained that Claude invented names for things like author tags because it did not know who it was working for. Anthropic responded by adding the account email to the model's context. When Claude later wrote a command itself, "it sometimes put your email address in the User-Agent as a contact address." She called it something that "should not have happened."

This was reported months ago

The November issue went viral, but it was not the first warning. Issue #81138, opened on July 25, 2026, describes the same root cause in detail: the account email from the local Claude config file is injected into the model's context on every session, without a documented way to turn it off. The author found the behavior by decompiling the shipped bundle and listed four earlier reports that had been closed for inactivity or as duplicates. Another issue, #55743, raised the same point in early May.

The comment history on #81138 reads like a slow countdown. In late August a user who inspected version 2.1.246 found that Anthropic had added a sentence telling the model to never send the address to an unrelated service, for example in a request header. That is an instruction, not a control. In September and October other users reported that the agent overrode their git identity with the subscription email, and on October 20 one user posted that the web version of Claude Code had put their email into User-Agent headers despite that instruction. A later commenter noted that subagents receive the address too, which widens the number of model instances that can make the mistake.

What Anthropic changed, and what it did not

There are two fixes on the table. The first already shipped. The Claude Code changelog for version 2.1.317 lists "a check that asks before a web or shell tool call sends your account email address to the network." In the GitHub thread, an Anthropic developer described it as a built-in mod called cc-plugin-privacy that is on by default and can be switched off through the plugins menu. Anthropic later made the mod's source available for review.

The second fix is the real one. Hallie wrote that Anthropic is removing the account email from the context Claude Code gives the model, and that the update should arrive in the next release, which she expected early next week. Until then, she said, the mod "still doesn't prevent all cases, like when Claude writes a script and runs on its own." She also pointed out that the stable release channel was still on version 2.1.311 at that point, so users on stable did not have the check at all.

Users in the thread tested the mod and reported gaps. Several people on macOS and Windows wrote that on versions 2.1.317, 2.1.318 and 2.1.319, a test command combining their account address with the words User-Agent was not refused, even though the mod showed as loaded. Another user pointed out that the mod only looks at shell input, so if the model first writes the address into a script file and then runs the script, nothing in the checked command contains the address. These are user reports, not confirmed findings, but they line up with Anthropic's own caveat.

Removing the email is not the end of it

Taking the address out of the system prompt solves the specific bug. It does not solve the class of problem. Several commenters made the same point in different words: the model can still read your git log, your config files, and your project names. One user scanned their own session logs and found that the model often invents a descriptive product name for its User-Agent, built from the project or client it is working on. A header like that can tell a third-party site who you are and what you are building, even with no email inside.

Another user scanned roughly three months of local transcripts and found 53 tool calls across 8 sessions that put their address into a User-Agent, almost all written by workflow subagents rather than the built-in web fetch tool. That is one person's log, not a study, but it shows why the issue matters at scale. Claude Code has a large user base, so even a small leak rate becomes a large list of addresses spread across API providers.

Why this matters beyond one product

This is a clean example of a pattern that will repeat across every agent product. The model did not get hacked. No attacker injected a prompt. A public website published a reasonable policy for scripts, the agent read it or remembered it, and it tried to be helpful with the data in its context. That is exactly the behavior agents are sold on: read the docs, figure it out, finish the task.

The trouble is that "helpful" and "private" pull in different directions once an agent holds personal data and has network access. Security researchers sometimes call this the lethal trifecta: private data, exposure to untrusted content, and a way to send data out. Claude Code had all three by default for signed-in users. The model's instruction to not share the address was a soft rule sitting on top of a hard capability.

There is also a regulatory angle. Commenters in Europe raised the GDPR, since an email address is personal data and it was sent to third parties without consent. Whether a regulator acts is an open question, and we will not guess at an outcome. But the argument is easy to make, and it lands while Anthropic prepares for an IPO.

What to do right now

If you use Claude Code with a claude.ai account, a few steps are worth taking today.

• Update to version 2.1.317 or later, and confirm the privacy mod shows as enabled in the plugins menu. If you are on the stable channel, check which version you actually run.
• Search your local session logs for your address. Users in the thread scanned the JSONL transcripts in the Claude projects folder for their email next to User-Agent strings. If you find hits, you know which sites received it.
• Add your own guard. Several open source PreToolUse hooks now refuse tool calls or file writes that contain your account address. One author reported that their hook cut leaking runs from 8 of 60 to 0 of 60 in their own tests.
• Use a separate or masked address for tools that run agents, and a no-reply address for git commits. Anything the agent can read, it can send.
• Watch for the next release that removes the email from context, then update again.

For teams, the bigger lesson is to treat agent network access like any other egress. Allow lists for outbound domains, a proxy that strips or rewrites headers, and logs you actually review are cheap compared with explaining a leak to customers.

djcroman take

The bug itself is small: one string in one header. The story is how long it took. The root cause was documented in public in July, with code excerpts and a list of earlier reports, and the fix arrived only after a scam mail flood hit Hacker News. A company that ships code at the speed Anthropic says it does should not need 1,588 Hacker News points to remove an email address from a prompt.

The deeper problem is the design choice. Putting personal data into an agent's context to fix a cosmetic issue like author tags is a bad trade, and adding a sentence that tells the model not to misuse it is not a safety control. The right default for any agent that composes its own requests is a generic User-Agent with nothing taken from the session, plus a hard check outside the model before anything personal leaves the machine. Anthropic is moving in that direction now. The question for every other agent vendor is whether they wait for their own viral issue first.

Which leaks worry you more in agent tools: emails in headers, or project and client names that nobody filters at all?

Sources

• GitHub issue #107757: Privacy violation in User-Agent header
• GitHub issue #81138: Account email injected into the model's system prompt
• Claude Code changelog (version 2.1.317 and later)
• Hacker News discussion with comments from Claude Code staff
• SEC: Accessing EDGAR Data, declared user agent policy
• LavX News coverage of the privacy fix